From 205fba74cffffb9df985cdf928101633ffc41772 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max@duempel.org>
Date: Fri, 16 Oct 2015 14:40:46 +0200
Subject: [PATCH] tag/ApeLoader: fix buffer overflow after unterminated key

---
 NEWS                  |  2 ++
 src/tag/ApeLoader.cxx | 12 ++++++------
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/NEWS b/NEWS
index 65252a614..7e5f41b3b 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,6 @@
 ver 0.19.11 (not yet released)
+* tags
+  - ape: fix buffer overflow
 
 ver 0.19.10 (2015/06/21)
 * input
diff --git a/src/tag/ApeLoader.cxx b/src/tag/ApeLoader.cxx
index f473c910e..f51cb5c0b 100644
--- a/src/tag/ApeLoader.cxx
+++ b/src/tag/ApeLoader.cxx
@@ -78,12 +78,12 @@ ape_scan_internal(FILE *fp, ApeTagCallback callback)
 
 		/* get the key */
 		const char *key = p;
-		while (remaining > size && *p != '\0') {
-			p++;
-			remaining--;
-		}
-		p++;
-		remaining--;
+		const char *key_end = (const char *)memchr(p, '\0', remaining);
+		if (key_end == nullptr)
+			break;
+
+		p = key_end + 1;
+		remaining -= p - key;
 
 		/* get the value */
 		if (remaining < size)